Interface ISamlSignInDenialService

Namespace

Fdyay.IdentityServer.Services

Assembly

Fdyay.IdentityServer.AspNetCore.dll

Records a user's denial of a pending SAML sign-in, for the sign-on endpoint to answer the service provider with.

public interface ISamlSignInDenialService

Remarks

Duende 8.0.1's DenyAuthenticationAsync, measured, writes a SAML denial onto the stored sign-in state, and its callback endpoint reads it back and answers the service provider with an error status — as the authorize endpoint reads back a consent decision. Duende's interaction service holds the SAML state store itself; here SAML is its own package, built on this one, so the interaction service hands any context it does not own to this, as it asks ISamlLogoutNotificationService for the signed-out page's SAML logout requests.

The implementation is the SAML package's, registered by AddSaml. With none registered, a SAML sign-in cannot be denied.

Methods

TryDenyAsync(IAuthenticationContext, InteractionError, string?, CancellationToken)

Records the denial when context is a SAML sign-in; false when it is not one.

Task<bool> TryDenyAsync(IAuthenticationContext context, InteractionError interactionError, string? errorDescription, CancellationToken cancellationToken = default)

Parameters

context IAuthenticationContext

interactionError InteractionError

errorDescription string

cancellationToken CancellationToken

Returns

Task<bool>

Remarks

True as well when the sign-in it names is no longer waiting — expired, or already answered — as Duende's: there is nothing left to record the denial on, and it is logged rather than thrown.